MCTS 70-640 MCTS 70 640: Active Directory, Configuring 2 — Questions and Answers
Question 1: You need to configure Active Directory to allow users in a child domain to access resources in the parent domain without requiring separate credentials. Which trust type is automatically created between parent and child domains in the same forest?
- External trust
- Forest trust
- Transitive two-way trust (Correct answer)
- Shortcut trust
Correct answer: Transitive two-way trust
Parent-child domains in the same forest are automatically joined by a transitive two-way trust, allowing resource access across the domain hierarchy.
Question 2: An administrator needs to ensure that the Password Replication Policy (PRP) on an RODC allows a specific user's credentials to be cached. Which tool should be used to add the user to the Allowed RODC Password Replication Group?
- Active Directory Sites and Services
- Active Directory Users and Computers (Correct answer)
- Ntdsutil
- Repadmin
Correct answer: Active Directory Users and Computers
Active Directory Users and Computers is used to manage the Allowed RODC Password Replication Group membership on an RODC object.
Question 3: Your company has a single AD DS forest with three domains. You want to reduce authentication latency between two specific domains that frequently access each other's resources. What should you create?
- External trust
- Forest trust
- Realm trust
- Shortcut trust (Correct answer)
Correct answer: Shortcut trust
A shortcut trust between two domains in the same forest reduces the authentication path, improving performance for cross-domain resource access.
Question 4: Which attribute of a user account in Active Directory stores the user's logon name in the format required for pre-Windows 2000 compatibility?
- userPrincipalName
- sAMAccountName (Correct answer)
- distinguishedName
- cn
Correct answer: sAMAccountName
The sAMAccountName attribute stores the pre-Windows 2000 logon name (DOMAIN\username format) used for legacy compatibility.
Question 5: You are configuring AD DS to support multiple UPN suffixes so users can log on with their company email address. Where do you add additional UPN suffixes?
- Active Directory Domains and Trusts (Correct answer)
- Active Directory Users and Computers
- Active Directory Sites and Services
- Group Policy Management Console
Correct answer: Active Directory Domains and Trusts
Additional UPN suffixes are added in Active Directory Domains and Trusts by right-clicking the root node and selecting Properties.
Question 6: An RODC in a branch office is being decommissioned. Which step must you perform to ensure the RODC's metadata is cleanly removed from AD DS?
- Run dcpromo /forceremoval on the RODC
- Use ntdsutil metadata cleanup (Correct answer)
- Delete the RODC object from AD Sites and Services
- Run repadmin /removelingeringobjects
Correct answer: Use ntdsutil metadata cleanup
Ntdsutil metadata cleanup removes lingering AD DS metadata for a domain controller that cannot be demoted normally.
Question 7: You want to delegate the ability to reset passwords for users in a specific OU to a help desk group without granting them Domain Admin rights. What should you use?
- Modify the Default Domain Policy GPO
- Use the Delegation of Control Wizard on the OU (Correct answer)
- Add the group to the Account Operators group
- Modify the AdminSDHolder object permissions
Correct answer: Use the Delegation of Control Wizard on the OU
The Delegation of Control Wizard on a specific OU grants granular permissions, such as password resets, without elevating the group's domain-wide privileges.
MCTS 70-640 MCTS 70 640: Active Directory, Configuring 2
You need to configure Active Directory to allow users in a child domain to access resources in the parent domain without requiring separate credentials.
Which trust type is automatically created between parent and child domains in the same forest?